DGX servers (BMC firmware < 2.09.00): RCE on BMC (buffer overflow)

CVSS 8.4CVE-2022-42271NVIDIA / GPU stackcurated

Impact

RCE on BMC (buffer overflow)

Who can reach it

Network-adjacent mgmt-LAN attacker

What to do

Flash BMC to 2.09.00+ out-of-band

References

https://nvd.nist.gov/vuln/detail/CVE-2022-42271 https://github.com/NVIDIA/product-security/tree/main/2024/5513

Related entries

NVIDIA DCGM - nv-hostengine: A heap-based buffer overflow reachable through the bound socket gives denial of serviceCVE-2023-0208 · NVIDIA DCGM - nv-hostengineHigh
NVIDIA Isaac Lab (Isaac Sim): SB3 configuration parsing reaches code execution with no privileges and no userCVE-2025-23356 · NVIDIA Isaac Lab (Isaac Sim)High
NVIDIA Resiliency Extension: Predictable log-file names in the log-aggregation path let an attacker pre-createCVE-2025-33225 · NVIDIA Resiliency ExtensionHigh
TensorRT-LLM: RCE via unsafe deserializationCVE-2026-24233 · TensorRT-LLMHigh
DGX H100 BMC: Privesc + code execution (web UI input validation)CVE-2023-25533 · DGX H100 BMCHigh
DGX H100 BMC (REST): Code execution + privescCVE-2023-31009 · DGX H100 BMC (REST)High

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.